Error detection and remediation using an error signature

ABSTRACT

A computer system is provided. The computer system includes a memory, a network interface, and at least one processor configured to monitor a user interface comprising a plurality of user interface elements; detect at least one changed element within the plurality of user interface elements; classify, in response to detecting the at least one changed element, the at least one changed element as either indicating or not indicating an error; generate, in response to classifying the at least one changed element as indicating an error, an error signature that identifies the at least one changed element; identify, using the error signature, a remediation for the error; and provide the remediation in association with the at least one changed element.

BACKGROUND

Software support systems provide tools that enable end users and supportpersonnel to collaborate to find workarounds or other resolutions tosystem errors encountered by the end users. For example, some softwaresupport systems provide end users with searchable support articlesthrough which the users can find resolutions to many common problems.Other software support systems enable end users or support personnel toopen tickets to document and manage each supportable incident reportedby an end user. These tickets remain open until the incident associatedwith the ticket is resolved. Further some software support systemsutilize tickets to provide both end users and support personnel withinformation regarding the status of the incident and to drive supportworkflow. Further still, some types of software support systems enablesupport personnel to review and/or control a computer system associatedwith the end user for diagnostic purposes. Collectively, these softwaresupport systems provide the end user and support personnel with aneffective set of tools upon which to rely when troubleshooting systemerrors.

SUMMARY

In at least one example, a computer system is provided. The computersystem includes a memory; a network interface; and at least oneprocessor coupled to the memory and the network interface and configuredto monitor a user interface comprising a plurality of user interfaceelements; detect at least one changed element within the plurality ofuser interface elements; classify, in response to detecting the at leastone changed element, the at least one changed element as eitherindicating or not indicating an error; generate, in response toclassifying the at least one changed element as indicating an error, anerror signature that identifies the at least one changed element;identify, using the error signature, a remediation for the error; andprovide the remediation in association with the at least one changedelement.

At least some examples of the computer system can include one or more ofthe following features. The plurality of user interface elements can berepresented in hypertext markup language (HTML) and the at least oneprocessor can be configured to monitor the user interface at least inpart by scanning a document object model representing the plurality ofuser interface elements. The at least one processor can be configured tomonitor the user interface at least in part by exchanging messages witha UI automation process. The at least one processor can be configured tomonitor the user interface at least in part by executing a browserplugin. The at least one processor can resides within a server and canbe further configured to implement a browser configured to execute thebrowser plugin and provide the remediation in association with the atleast one changed element. The at least one processor can reside withina client computing device and can be further configured to implement anapplication comprising an embedded browser configured to execute thebrowser plugin and provide the remediation in association with the atleast one changed element. The at least one processor can reside withina client computing device and can be further configured to implement anapplication comprising an embedded browser configured to provide theremediation in association with the at least one changed element.

In the computer system, the plurality of user interface elements can berepresented by HTML, the at least one processor can reside within agateway, and can be configured to monitor the user interface at least inpart by scanning HTML for changes. The at least one processor can beconfigured to monitor the user interface at least in part by executing abackground application configured to process notifications regardinguser interface events. The at least one processor can be configured tomonitor the user interface at least in part by loading a library into anapplication configured to provide the user interface. The at least oneprocessor can be configured to classify the at least one changed elementat least in part by executing a keyword search and/or a machine learningprocess. The keyword search and/or the machine learning process can betailored to a type of monitored application. The at least one changedelement can be stored as image data and the at least one processor canbe configured to execute an optical character recognition process and/ora computer vision process to process the image data. The at least oneprocessor can be configured to generate the error signature using ahierarchy of user interface elements terminating with at the at leastone changed element, an identifier of an application that generated theat least one changed element, and/or metadata descriptive of the atleast one changed element.

In the computer system, the at least one processor can be configured toprovide the remediation at least in part by disposing a remediationmessage either over or adjacent to the at least one changed element. Theat least one processor can be configured to provide the remediation atleast in part by providing a remediation message in a window distinctfrom the at least one changed element. The computer system can furthercomprising a server and the at least one processor can be furtherconfigured to transmit the error signature to the server via the networkinterface. The server can be configured to receive a plurality of errorsignatures including the error signature; calculate a count of each typeof error signature; provide the count within a triage interface screen;and receive, via the triage interface screen, input specifyingremediations for each type of error signature. The server can be furtherconfigured to filter the plurality of error signatures to include errorsignatures specific to an application, region, and/or businessorganization. The at least one processor can be configured to providethe remediation at least in part by installing a fix on the computersystem.

In at least one example, a method of remediating software applicationerrors is provided. The method includes acts of monitoring, by acomputer system, a user interface comprising a plurality of userinterface elements; detecting, by the computer system, at least onechanged element within the plurality of user interface elements;classifying, by the computer system in response to detecting the atleast one changed element, the at least one changed element as eitherindicating or not indicating an error; generating, by the computersystem in response to classifying the at least one changed element asindicating an error, an error signature that identifies the at least onechanged element; transmitting, by a computer system, the error signatureto a server; receiving, from the server by the computer system, aremediation to the error; and providing, by the computer system, theremediation in association with the at least one changed element.

At least some examples of the method can include one or more of thefollowing features. The act of monitoring the user interface can includean act of monitoring the user interface via a browser plugin. The act ofclassifying the at least one changed element can include an act ofexecuting a keyword search and/or a machine learning process. The act ofgenerating the error signature can include an act of generating an errorsignature using a hierarchy of user interface elements terminating withat the at least one changed element, an identifier of an applicationthat generated the at least one changed element, and/or metadatadescriptive of the at least one changed element. The act of providingthe remediation can include an act of disposing a remediation messageeither over or adjacent to the at least one changed element. The methodcan further include acts of receiving, by the server, a plurality oferror signatures including the error signature; calculating, by theserver, a count of each type of error signature; providing, by theserver, the count within a triage interface screen; and receiving, bythe server via the triage interface screen, input specifyingremediations for each type of error signature.

Still other aspects, examples and advantages of these aspects andexamples, are discussed in detail below. Moreover, it is to beunderstood that both the foregoing information and the followingdetailed description are merely illustrative examples of various aspectsand features and are intended to provide an overview or framework forunderstanding the nature and character of the claimed aspects andexamples. Any example or feature disclosed herein can be combined withany other example or feature. References to different examples are notnecessarily mutually exclusive and are intended to indicate that aparticular feature, structure, or characteristic described in connectionwith the example can be included in at least one example. Thus, termslike “other” and “another” when referring to the examples describedherein are not intended to communicate any sort of exclusivity orgrouping of features but rather are included to promote readability.

BRIEF DESCRIPTION OF THE DRAWINGS

Various aspects of at least one example are discussed below withreference to the accompanying figures, which are not intended to bedrawn to scale. The figures are included to provide an illustration anda further understanding of the various aspects and are incorporated inand constitute a part of this specification but are not intended as adefinition of the limits of any particular example. The drawings,together with the remainder of the specification, serve to explainprinciples and operations of the described and claimed aspects. In thefigures, each identical or nearly identical component that isillustrated in various figures is represented by a like numeral. Forpurposes of clarity, not every component may be labeled in every figure.

FIG. 1 is a block diagram of an error remediation (ER) system inaccordance with an example of the present disclosure.

FIG. 2 is a block diagram of a user interface (UI) monitor in accordancewith an example of the present disclosure.

FIG. 3 is a block diagram of a network environment of computing devicesin which various aspects of the present disclosure can be implemented.

FIG. 4 is a block diagram of a computing device that can implement oneor more of the computing devices of FIG. 3 in accordance with an exampleof the present disclosure.

FIG. 5 is a block diagram of the ER system of FIG. 1 as implemented by aspecific configuration of computing devices in accordance with anexample of the present disclosure.

FIG. 6 is a block diagram of the ER system of FIG. 1 as implemented by aspecific configuration of computing devices in accordance with anexample of the present disclosure.

FIG. 7 is a block diagram of the ER system of FIG. 1 as implemented by aspecific configuration of computing devices in accordance with anexample of the present disclosure.

FIG. 8 is a block diagram of the ER system of FIG. 1 as implemented by aspecific configuration of computing devices in accordance with anexample of the present disclosure.

FIG. 9 is a block diagram of the ER system of FIG. 1 as implemented by aspecific configuration of computing devices in accordance with anexample of the present disclosure.

FIG. 10 is a flow diagram of an ER process in accordance with an exampleof the present disclosure.

FIG. 11 is a front view of a screen provided by a triage interface inaccordance with an example of the present disclosure.

FIG. 12 is a flow diagram illustrating a triage process in accordancewith an example of the present disclosure.

FIG. 13 is a front view of a screen provided by a monitored applicationand the ER system of FIG. 1 in accordance with an example of the presentdisclosure.

FIG. 14 is a front view of a screen provided by a monitored applicationand the ER system of FIG. 1 in accordance with an example of the presentdisclosure.

DETAILED DESCRIPTION

As summarized above, various examples described herein are directed toerror remediation systems and methods for use with computing devices.These systems and methods overcome technical difficulties that arisewhen errors are encountered, for example, in a monitored applicationthat requires a patch, upgrade, or change in configuration, but supportpersonnel are unable to perform the required activity. In thesesituations, support personnel may be unable to fix to the root cause ofthe error but are still tasked with supporting end users who encounterthe error.

To address this issue, some support personnel send emails or other sortsof messages to end users who may be affected by a given error and/orother users as a precautionary measure. But this approach isunsatisfactory in that the end users must still endure the error. Often,despite the email sent by the support personnel, the end users respondto errors by opening tickets to be serviced by the support personnel,especially where a resolution or workaround is difficult for the enduser to perform. This end user behavior can be particularly troublesomewhere a single incident causes an error that effects a large number ofusers. In these situations, a large volume of tickets may be opened,thus forcing support personnel to triage multiple instances of the sameissue, which results in a large amount of redundant and duplicatedeffort.

Thus, and in accordance with at least some examples disclosed herein,error remediation systems and methods are provided. These systems andmethods provide for on-the-fly remediation of errors associated witherror messages in a variety of monitored software applications, such asweb applications, software as a service (SaaS) applications, virtualapplications, and local applications (e.g., Windows® applications). Insome examples, an error remediation system detects an error message,generates an error signature unique to the error message, matches thesignature to a signature stored in an error record that documents apreviously triaged and remediated instance of the error message, fetchesa remediation stored in the record, and provides the remediation to theend user. Further, in some examples, the error remediation systemprovides a user interface to support personnel that enables the supportpersonnel to identify error messages being encountered by end users,triage the error messages to select error messages with the most impacton the end users, and define remediations for the selected errormessages. Remediations defined by the support personnel via this triageuser interface are stored within error records documenting the errormessage and its remediation, thereby enabling the error remediationsystem to provide the remediation to end users who encounter the errormessage in the future.

As will be understood in view of this disclosure, the error remediationsystems and methods provided herein have several advantages over othersupport automation. For instance, the error remediation systems andmethods described herein enable automatic and immediate remediations forerror messages without requiring modifications to a monitoredapplication. This can be particularly helpful where the monitoredapplication cannot be modified by the support personnel. Further, theerror remediation systems and methods described herein enable supportpersonnel to identify and remediate errors based on, for example, thenumber of users affected and/or the severity of the error message. Inaddition, once a remediation to an error message is established, thatremediation is automatically provided to all users who encounter theerror message. This can help prevent end users from repetitivelyencountering, and potentially opening tickets for, the same issueswithout some form of remediation being provided. Through these features,the error remediation systems and methods described herein magnify thepositive impact support personnel can provide to the end users theysupport. Moreover, the error remediation systems and methods describedherein enable the development or support personnel to input remediationsto errors discovered during final regression testing of a release,thereby decreasing the support calls after the release is in production.These and other advantages will be recognized in view of thisdisclosure.

In certain examples, an error remediation system as disclosed hereinoperates on data descriptive of UI elements displayed or to be displayedwithin the user interface of a computer system. For instance, in someexamples, the error remediation system detects error messages bymonitoring UI elements displayed, or to be displayed, in the UI;identifying changes in the UI elements; and executing a classifier inresponse to identifying changes in the UI elements. These UI elementscan be provided by one or more monitored applications. In some examples,the classifier determines whether the UI, including the changed UIelements, depicts an error message. In these examples, the errorremediation system can execute detection operations by processing a widevariety of UI data. Examples of this UI data include hypertext markuplanguage (HTML) descriptive of the UI elements, UI automation messagesdescriptive of the UI elements, hook messages descriptive of the UIelements, and image data depicting rendered UI elements. The HTMLdescriptive of the UI elements can be organized within, for example, adocument object model (DOM).

The error message detection processes that operate on the UI data can behoused within various components of the error remediation system. Forinstance, in some examples, these detection processes are housed withina browser plugin or extension. In these examples, the detectionprocesses operate on HTML data to execute the detection operationsdescribed herein. For instance, the detection process can scan a DOMincluding the HTML data. In other examples, the error message detectionprocesses are housed within a browser itself, and thus no plugin orextension is required. In these examples, the error message detectionprocesses operate on HTML data to execute the detection operationsdescribed herein. It should be noted that the browser or browser plugincan be executed by a virtual machine hosted by a physical server.

In other examples, the error message detection processes are housedwithin an application executed by an intermediate device (e.g., anapplication delivery controller (ADC)) disposed between an applicationserver and an application client. In these examples, the error messagedetection processes operate on HTML data and/or image data passingbetween the client application and the server application. In otherexamples, the error message detection processes are housed within alocal process supported by an operating system of a client device thatalso renders the UI. This local process can execute in the background asan independent process, can execute as part of a virtualization service,and/or can execute as a part of the monitored application that generatesthe UI. In these examples, the error message detection processes canoperate on UI automation messages, hook messages, HTML and/or other UIdata generated by the monitored application.

A variety of classifiers can be used to detect error messages within UIdata. For instance, in some examples, the error remediation systemexecutes a classifier that scans the UI data, or data derived from theUI data, for keywords associated with error messages. This derived datacan include text data output from an optical character recognition (OCR)and/or computer vision processes. In other examples, the classifierexecutes a machine learning process that operates on input including theUI data and/or data derived from the UI data. In these examples, themachine learning process can be trained to recognize text and/or objectscommonly displayed at particular locations when an error message isencountered. In some examples, the error remediation system executes asingle classifier for all changes in UI elements. In other examples, theerror remediation system executes one or more classifiers that aretailored to specific types of monitored applications.

In some examples, the error remediation system forms, in response todetecting an error message, a signature uniquely identifying the errormessage. The attributes of a signature can vary between examples and/ortypes of monitored applications. For instance, where the UI data is HTMLdata, the signature can include a UI hierarchy derived from a DOMincluding the HTML data. This UI hierarchy can include a root object anda line of descendant objects that terminates in an object storing theerror message. Similarly, where the UI data are UI automation messagesand/or hook messages, the signature can include a UI hierarchy thatincludes a root automation or hook element and a line of descendantautomation or hook elements that terminates in an automation or hookelement representing the error message.

In certain examples, a signature can include other attributes. Forinstance, in some examples, the attributes of a signature can includeidentifiers such as a title, universal resource locator (URL), or hostfor a page served by a monitored web or SaaS application. Alternativelyor additionally, a signature can include a title of window or dialogprovided by a local monitored application or a process name associatedwith the local monitored application. A signature can also includemetadata descriptive of the error message, as described further below.

In some examples, the error remediation system provides on-the-flyremediations to previously identified and triaged error messages as andwhen the error messages are encountered by end users. For instance, incertain examples, the error remediation system uses the signature of anerror message encountered by an end user to identify a remediation forthe error message. For example, the error remediation system can searchfor and find an error record that includes the signature and aremediation for the error identified by the signature. In some examples,the error remediation system immediately overlays the error message witha remediation message stored in the identified error record.Alternatively or additionally, the error remediation system can providethe remediation message adjacent to the error message or in a windowdistinct from the error message. The remediation message can includetext describing a work around, including a link to additional resourcesregarding the error message, etc. Further, in some examples, the errorremediation system matches visual characteristics (colors, font,duration, style, etc.) of a remediation message to the overall theme ofthe user interface. It should be noted that the error remediation systemcan provide remediations without requiring any changes to theapplication generating the error message being remediated.

In other examples where the error remediation system is capable ofmodifying the monitored application, the identified remediation mayinclude a link to an installable package. In these examples, the errorremediation system can apply the installable package to the monitoredapplication to remediate the error message. The installable package caninclude, for example, a patch build with changes to the monitoredapplication and/or information to reconfigure the settings of themonitored application.

In some examples, the error remediation system provides a user interfacethat enables support personnel to triage and remediate errorsencountered by end users. For instance, in some examples, this triageinterface tabulates and provides counts and frequencies of errormessages grouped by monitored application, customers, regions, sites,etc. In these examples, the triage interface interacts with supportpersonnel to receive input descriptive of remediations. In response toreceiving such input, the triage interface stores the remediations inerror records that associate the remediations with signatures of errorsmessages to which the remediations apply. Further, in some examples, thetriage interface interacts with support personnel to maintain (updateand/or rollback) the classifier used to detect error messages. It shouldbe noted that users of the triage interface can include supportpersonnel (e.g., information technology administrators) employed by thesame business organization as the end users and/or support personnelemployed by a service provider distinct from the employer of the endusers. Thus, the triage interface can be widely utilized to the benefitof end users.

The error remediation system can provide the triage interface via avariety of implementation techniques, such as by serving the triageinterface via a web server and/or by incorporating and interoperatingwith a local application. In some examples, the error remediation systemexposes an application program interface (API) through which it providesthe triage interface. In some examples, the error remediation systemhosts the triage interface processes described herein on a serverdistinct from the other processes executed by the error remediationsystem. Other implementation techniques for the triage interface will beapparent in view of this disclosure.

Examples of the methods and systems discussed herein are not limited inapplication to the details of construction and the arrangement ofcomponents set forth in the following description or illustrated in theaccompanying drawings. The methods and systems are capable ofimplementation in other examples and of being practiced or of beingcarried out in various ways. Examples of specific implementations areprovided herein for illustrative purposes only and are not intended tobe limiting. In particular, acts, components, elements and featuresdiscussed in connection with any one or more examples are not intendedto be excluded from a similar role in any other examples.

Also, the phraseology and terminology used herein is for the purpose ofdescription and should not be regarded as limiting. Any references toexamples, components, elements or acts of the systems and methods hereinreferred to in the singular can also embrace examples including aplurality, and any references in plural to any example, component,element or act herein can also embrace examples including only asingularity. References in the singular or plural form are not intendedto limit the presently disclosed systems or methods, their components,acts, or elements. The use herein of “including,” “comprising,”“having,” “containing,” “involving,” and variations thereof is meant toencompass the items listed thereafter and equivalents thereof as well asadditional items. References to “or” can be construed as inclusive sothat any terms described using “or” can indicate any of a single, morethan one, and all of the described terms. In addition, in the event ofinconsistent usages of terms between this document and documentsincorporated herein by reference, the term usage in the incorporatedreferences is supplementary to that of this document; for irreconcilableinconsistencies, the term usage in this document controls.

Error Remediation System

In some examples, an error remediation system is configured to identifyand timely remediate error messages generated by monitored applications.These monitored applications can include any process capable ofdisplaying information within the UI of a client device, such as locallyexecuted applications, web applications, SaaS applications, and thelike. FIG. 1 illustrates a logical architecture of an error remediationsystem 100 in accordance with some examples. As shown in FIG. 1, thesystem 100 includes a UI monitor 102, an ER service 104, an error datastore 106, a remediator 108, and a triage interface 110.

FIG. 1 further illustrates types of UI data 112 that can be processed bythe UI monitor 102 and components that generate the data 112. As shown,the data 112 can include one or more of hook messages 116, UI automationmessages 118, and/or HTML 124. The hook messages 116 and UI automationmessages 118 are generated from UI related processes executed by amonitored application 114. The HTML 124 originates from a serverapplication 122 and is served to the monitored application 114. In someexamples, the HTML 124 is transmitted to the monitor 102 from the server122 via a gateway process 126 before the HTML 124 is received by themonitored application 114. In other examples, the HTML 124 istransmitted to the monitor 102 by the monitored application 114 after itis received by the monitored application 114.

In some examples, the monitor 102 is configured to receive and processone or more of the hook messages 116, the automation messages 118, andthe HTML 124. In other examples, the monitor 102 is configured toprocess two or more of types of the data 112. In either case, themonitor 102 can be configured to acquire the data 112 using a variety oftechniques. For instance, in some examples, the monitor 102 isconfigured to periodically poll sources (e.g., the monitored application114, the server application 122, and/or the gateway process 126) of thedata 112. In other examples, the monitor 102 is configured to register,with the sources of the data 112, to receive notifications regardingchanges to the UI of the monitored application 114.

In some examples, the monitor 102 is configured to identify the errormessages within the UI by first identifying changes to the UI and thenanalyzing those changes to determine whether the changes include anerror message. The processes that the monitor 102 is configured toexecute to identify the changes to the UI depend on the type of UI dataavailable. For instance, in some examples, the monitor 102 is configuredto receive notifications that precisely identify changes to the UI ofthe monitored application 114. In these examples, to identify thechanges to the UI, the monitor 102 is configured to simply parse thenotifications and store data descriptive of the changes in memory forsubsequent processing.

In other examples, the monitor 102 is configured to construct and/orinspect a time sequence of representations of the UI of the monitoredapplication 114. In these examples, the monitor 102 is configured toidentify the changes to the UI by contrasting consecutiverepresentations in the time sequence and recording differences betweenthe consecutive representations. These differences can include elementswithin a first representation of the UI that have no correspondingelements within a second representation of the UI. The differences canalso include elements within the first representation that havecorresponding elements within the second representation where theelements and the corresponding elements have differing attributes. Asdiscussed in more detail below with reference to FIG. 2, theserepresentations can include DOMs or representations constructed from UIautomation or hook messages.

In some examples, the monitor 102 is configured to determine whether anyidentified changes to the UI include error messages by executing aclassifier. This classifier can be configured according to any of avariety of classification techniques. For instance, in some examples,the monitor 102 is configured to execute a classifier that searches theidentified changes for one or more keywords associated with errormessages within a user-configurable dictionary. Examples of words thatcan be included in this dictionary include “failure,” “exception,”“error,” “terminated,” “denied,” “fatal,” and the like. In someexamples, the monitor 102 is configured to periodically update theuser-configurable dictionary with synonyms via a cloud service API, suchas the Thesaurus API. Further, in some examples, the monitor 102 isconfigured to expose the user-configurable dictionary as a serviceendpoint. In some examples, the monitor 102 is configured to label anidentified change as including an error message where the identifiedchange includes a text value matching a word from the dictionary.Alternatively or additionally, where the identified changes includeimage data, the monitor 102 can be further configured to execute aclassifier that inspects identified changes using OCR and/or computervision techniques. In these examples, the classifier can be trained toidentify text and/or icons within images that are commonly presented inerror messages.

In some examples, the monitor 102 is configured to generate a signaturethat can be used to identify future instances of an error message. Inthese examples, a signature includes a subset of the representation ofthe UI of the monitored application 114. For instance, in one example, asignature includes a subset of the representation that begins with aroot element and that continues through a line of descendants from theroot element to an element identified as an error message. For instance,in one example, a signature includes a set of identifiers comprising anidentifier of the monitored application 114, an identifier of a windowor page in which the error message is displayed, an identifier of themain process that generated the error message, an identifier of theelement in the representation corresponding to the error message, and/ormetadata descriptive of the error (e.g., error code, stack trace,process name, business organization, region, etc.).

To illustrate, in one example, the monitored application 114 can be aweb application (A1) that executes a main process (P1) that has a mainwindow (W1) with several UI elements (E1, E2, and E3). Within thiscontext, A1 can display an error message within a new window (W2)containing several new UI elements (E4, E5, and E6). Assuming E6 is theerror message, the signature can include a UI hierarchy such asA1→P1→W2→E6. Alternatively or additionally, A1 can display an errormessage within the W1 as element E3. The signature for this errormessage can include a UI hierarchy such as A1→P1→W1→E3.

In some examples, the monitor 102 is configured to interoperate with theservice 104 to store signatures within error records or identifyremediations associated with error messages. In these examples, to storesignatures or retrieve remediations, the monitor 102 is configured totransmit requests to the service 104. These requests can include thesignatures. Further, in these examples, the monitor 102 is configured toreceive and process responses to the requests. To process the responses,the monitor 102 is configured to parse the responses to identifyacknowledgments or remediations. The acknowledgements can indicate thatthe service 104 created error records for the signatures in the errordata store 106. The remediations can be remediations retrieved by theservice 104 from the error data store 106 using the signatures. In theseexamples, the monitor 102 is configured to transmit the remediations, inresponse to receiving the same, to the remediator 108.

In certain examples, the monitor 102 is configured to interoperate withthe service 104 via one or more intermediate processes (e.g., a virtualdelivery agent (VDA) in a virtualized environment). For instance, insome examples where the intermediate process is a VDA, the monitor 102can be configured to interoperate with a VDA process hosted by theserver computer hosting the monitor 102. In these examples, thisserver-hosted VDA process can communicate via a communication channel(e.g., a virtual channel) with another VDA process hosted by a clientdevice where an end user is accessing a monitored application and theclient-hosted VDA process can communicate with the service 104. Thisconfiguration can be particularly advantageous where the client devicehas sufficient connectivity to interoperate with the service 104, butthe server computer does not.

In some examples, the data store 106 is organized to store errorrecords. Each of these error records associates a signature with aremediation by storing an identifier of the signature and an identifierof the remediation within fields of the same record. The data store 106is also configured to store other data elements associated withsignatures and remediations, such as remediation messages and links,signature metadata, and identifiers of monitored applications associatedwith the error messages and remediations. In some examples, theidentifiers of the monitored applications are stored separately from thesignatures to enhance system performance.

In some examples, the service 104 is configured to receive and processrequests from the monitor 102 to store signatures within error recordsor identify remediations from error records. In these examples, theservice 104 is configured to parse the requests, identify signaturesstored in the requests, and search the error data store 106 for errorrecords including the signatures. In some examples, the service 104 isfurther configured to create error records in the error data store 106where the service 104 is unable to identify existing error recordsstoring the signatures. In some examples, the service is also configuredto retrieve remediations from error records storing the signatures orincrement a counter in an error record storing the signature by omittinga remediation. In any case, the service 104 is configured to transmitresponses to the monitor 102. The responses can include either retrievedremediations or acknowledgements of the creation/modifications of errorrecords without remediations.

In certain examples, the service 104 is configured to provide themonitor 102 with a local copy of the data store 106 so that the monitor102 can expeditiously look up remediations associated with thesignatures it generates. In these examples, the service 104 can beconfigured to provide the local copy in response to a request receivedfrom the monitor 102 and/or to push the local copy to the monitor 102during initialization of the error remediation system 100 or in responseto an update of the data store 106. In other examples, the monitor 102is configured to use a two-tiered approach in which the monitor 102attempts to identify an error record storing a signature within a localcopy of the data store 106 and transmits a request to the service 104 tolook up the signature where it fails to find the signature in the localcopy of the data store 106.

In some examples, the triage interface 110 is configured to provide auser interface to interact with support users. This user interfaceenables the support users to identify error messages being encounteredby end users and specify remediations for the error messages. Oneexample of a user interface screen provided by the triage interface 110is described further below with reference to FIG. 11.

In some examples, the remediator 108 is configured to receive andprocess requests from the monitor 102 to provide remediations to errormessages. In these examples, the remediator 108 is configured to parsethe requests, identify remediations stored in the requests, and applythe remediations. The remediator 108 can be configured to provide any ofa variety of remediations to end users. For instance, in some examples,the remediator 108 is configured to deliver remediation messages storedin the remediations. These remediation messages can be displayed inconjunction with (e.g., adjacent to or overlaid upon) the error message.The remediation messages can instruct end users on a workaround for theerror identified by the error message. These remediation messages canalso include links that provide additional information on how toremediate the error. In other examples, the remediator 108 is configuredto apply fixes stored in the remediations that resolve the error.

In some examples, the remediator 108 is configured to alter a DOMincluding an object representing an error message to include an objectrepresenting a remediation message. In at least one of these examples,the remediator 108 is configured to overlay the remediation message ontothe error message using either DOM/shadow DOM API methods such ascreateElement, attachShadow, or the like on the root object of the DOM.In other examples, the remediator 108 is configured to provide theremediation message via other processes, which are described furtherbelow with reference to FIG. 9.

FIGS. 13 and 14 illustrate a window 1300 presented by one example of themonitored application 114. As shown in FIG. 13, the window 1300 includesan error message dialog 1302 and one form of remediation provided by theremediator 108, a remediation dialog 1304. The error message dialog 1302includes image data 1306, an error message 1308, and an error code 1310.The remediation dialog 1304 includes a remediation message 1312 and aremediation link 1314. The link 1314 provides access to an articledescribing a workaround to the error indicated by the error message1308. As shown in FIG. 13, the remediation dialog 1304 is displayedadjacent to the error message dialog 1302. As shown in FIG. 14, theremediation dialog 1304 partially overlays the error message dialog1302.

To enable processing of the various types of the data 112, the monitor102 can implement a system interface through which the monitor 102requests and/or receives the data 112 via any of a variety of messages.One example of such a system interface is shown in FIG. 2, whichillustrates the logical architecture of the monitor 102 in accordancewith some examples.

As shown in FIG. 2, the monitor 102 of FIG. 1 includes a systeminterface 202, a UI data filter 204, a UI data classifier 206, and asignature generator 208. In some examples, the system interface 202 isconfigured to interoperate with various components by exchangingmessages 200 with the components. These components can include, forexample, an ER service, a remediator, a monitored application and/or agateway process (e.g., the ER service 104, the remediator 108, themonitored application 114, or the gateway process 126 of FIG. 1). Themessages 200 can include the UI data (e.g., the data 112 of FIG. 1),signatures that identify error messages, and other data. The systeminterface 202 is configured to enable the monitor 102 to interoperatewith these various components. As such, the system interface 202 mayexpose and implement an application program interface (API) and/ortransmit and receive messages that conform with the APIs or interfacesof other components.

For instance, in some examples, the system interface 202 is configuredto interoperate with a gateway process or a monitored application torequest and receive HTML (e.g., the HTML 124 of FIG. 1), whichconstitutes a description of at least a portion of the UI of themonitored application. In other examples, the system interface 202 isconfigured to receive, from one or more operating system services, hookmessages and/or UI automation messages (e.g., the hook messages 116and/or the UI automation messages 118 of FIG. 1) descriptive of theoperation of monitored application. Further, in some examples, thesystem interface 202 is configured to interoperate with the ER serviceby transmitting messages to the ER service that include signaturesreceived from the signature generator 208.

In some examples, the filter 204 is configured to receive the UI datafrom the system interface 202 and determine whether the UI data includeschanges from previously analyzed UI data. In these examples, the filter204 is further configured to provide, where the UI data includes one ormore changes, differences between the UI data and the previouslyanalyzed data to the classifier 206.

The particular configuration of the filter 204 varies with the type ofthe UI data available to be processed. For instance, in certainexamples, the UI data represents a complete screen of the UI of themonitored application. In these examples, the filter 204 is configuredto maintain (e.g., in memory) a previous version of UI data to compareagainst a current version of the UI data to identify differences, whichmay represent error messages.

In one example, the filter 204 is configured to compare the HTML data topreviously received HTML data to determine whether the HTML dataincludes one or more changed HTML elements. To facilitate comparison ofthe HTML data and the previously received HTML data, the HTML data canbe received and/or stored in a first DOM and the previously receivedHTML data can be received and/or stored in a second DOM. To identifychanged HTML elements, the filter 204 can be configured to scan each DOMfrom its root object downward and to generate a set of identifiedobjects within the first DOM that have no corresponding object in thesecond DOM or that have a corresponding object with different attributesin the second DOM. This set of identified objects within the first DOMcan represent the one or more changed UI elements.

In some examples, the filter 204 is further configured to removeidentified objects that will not be reflected in the UI from the set ofidentified objects. For instance, in some examples, the filter 204 isconfigured to access the cascading styles sheets (CSS) attribute ofidentified objects and remove, from the set of identified objects, anyidentified objects for which the CSS attribute is set to “none.” Inother examples, the filter 204 is further configured to call thewindow.getComputedStyle( ) function to determine whether any HTMLelements within the DOM that are applied to an identified object wouldcause it to not be reflected in the UI. The filter 204 removes any suchobjects from the set of identified objects. In still other examples, thefilter 204 is further configured to assess the zIndex property ofidentified objects and remove, from the set of identified objects, anymembers that would not be reflected in the UI due to obstructions causedby other objects. In certain examples, the filter 204 is furtherconfigured to provide the filtered set of identified objects to theclassifier 206 for subsequent processing.

In another example, the filter 204 is configured to construct a currentrepresentation of the UI using the UI automation messages and/or thehook messages and to compare the current representation to a previouslyconstructed representation. In some examples, the filter 204interoperates with the UI automation and/or hook operating systemprocesses via the system interface 202 to construct the representationsused for comparison purposes. More specifically, the filter 204 isconfigured to construct the representations by enumerating eachautomation or hook element of the UI and determining, via attributes ofeach element, whether the element is to be visibly rendered within theUI. Elements that are to be visibly rendered are included in arepresentation. Elements that are not to be visibly rendered are notincluded in the representation.

In this example, to identify changed automation or hook elements, thefilter 204 can be configured to scan each representation from its rootelement downward and to generate a set of identified elements within thecurrent representation that have no corresponding element in theprevious representation or that have a corresponding element withdifferent attributes in the previous representation. In some examples,the filter 204 is configured to provide the changed elements to theclassifier 206 for further processing.

In some examples, the filter 204 is configured to receive, via thesystem interface 202, notifications that identify the changed DOMobjects or automation/hook elements. In these examples, the processingexecuted by the filter 204 is minimal, as the changed objects orelements are identified within the notifications. To enable the filter204 to receive notifications that identify the changed objects orelements, the filter 204 is configured to transmit a subscriptionrequest to the automation or hook process that monitors the monitoredapplication and/or to the monitored application itself. For instance, insome examples where the monitored application is a browser or includesan embedded browser, the filter 204 is configured to interoperate withthe browser via the MutationObserver Web API to subscribe tonotifications regarding DOM events. The MutationObserver Web API canprovide a set of events together, which allows the filter 204 to operatemore efficiently. Each notification provided by the MutationObserver WebAPI includes details of changed objects. In some examples, the filter204 is configured to process the details, such as new objects added tothe DOM and/or attribute changes to existing objects in the DOM. In asimilar fashion, the filter 204 can be configured to subscribe toWindows UI events via the UI Automation Framework API for various typesof controls. In these examples, the filter 204 is configured to providethe changed objects or elements to the classifier 206 for furtherprocessing. The filter 204 is also configured to take no additionalaction where no changed objects or elements are identified.

In some examples, the classifier 206 is configured to determine whetherchanged DOM objects or automation/hook elements represent an errormessage. In these examples, the classifier 206 is configured to receivethe changed objects or elements and to execute one or moreclassification processes depending on the type of data stored in theobjects or elements. For example, to handle a case where the type ofdata stored in the objects or elements is text data, the classifier 206is configured to execute a keyword search process to identify whetherthe text data includes any keywords from the user-configurabledictionary described above with reference to the monitor 102 of FIG. 1.In some examples, the keyword search process is configured to search forliteral keywords and text that matches one or more regular expressionsstored in metadata associated with the signatures. To handle a situationin which the type of data is image data, the classifier 206 can beconfigured to execute an OCR process (e.g., transmit a request to an OCRcloud API or execute locally) to extract text from the image data and toexecute the keyword search on the extracted text.

Additionally or alternatively, to handle a situation in which the typeof data is image data, the classifier 206 can be configured to execute amachine learning process trained to identify features within the imagedata that are commonly displayed in error messages. For example, theclassifier 206 can execute a convolutional neural network trained todetect error messages within image data. In this example, theconvolutional neural network can be trained to detect error text and/orother visual objects, such as stop sign icons, warning sign icons, andthe like within the image data. It should be noted that theclassification techniques described above can be combined in variousexamples of the classifier 206 in accordance with the principlesdescribed herein. The classifier 206 is further configured to providechanged objects or elements that represent an error message to thesignature generator 208 for further processing. The classifier 206 isalso configured to take no further action where the changed objects orelements do not represent an error message.

In some examples, the signature generator 208 is configured to generatesignatures that uniquely identify error messages and to provide thesignatures to the system interface 202 for subsequent processing. Asdescribed above, each signature can incorporate a subset of therepresentation of UI of the monitored application. This subset can be aset of identifiers of various DOM objects or automation/hook elements ofa UI hierarchy that begins with a root object or element and terminateswith an object or element representing an error message. The UIhierarchy can include an identifier of the monitored application, anidentifier of a window or page in which the error message is displayed,an identifier of the main process that generated the error message, anidentifier of the object or element that represents the error message.In some examples, the identifier of the monitored application can be aname of the monitored application. The identifier of a window or pagecan be the window title or the page title. The identifier of the mainprocess can be a name of the process and a module path for the monitoredapplication or a URL at which the monitored application can be accessed.The identifier of the object or element can be an object name (andattribute data) and/or an automation identifier, which can ensure thesignature is robust with regard to various human languageconfigurations. Examples of object or element structures used to storeidentifiers can include tuples such as <object type, object id, objectclass> and <div, #errorId, #errorclass>. By including application and UIhierarchy information within the signature, the signature generator 208ensures uniqueness of the signature, even across multiple monitoredapplications, thereby enabling precise and accurate automaticremediations.

In some examples, the signature generator 208 is configured to furtheridentify the object or element within the set of identifiers byincluding additional information regarding the context of the object orelement as rendered in the UI. In these examples, the signaturegenerator 208 is configured to determine coordinates of the errormessage within the UI through OCR or UI automation messages. Thesignature generator 208 is further configured to identify rendered UIelements positioned to the left, top, right, and bottom of the errormessage. The signature generator 208 can be further configured toidentify a title of the error message and to store any part of all ofthis information in the object or element identifier. Adding thisadditional information to the object or element identifier can beparticularly useful when processing error messages displayed within newwindows (e.g., dialog messages).

In some examples, the signature generator 208 is configured to includemetadata descriptive of the error (e.g., error code, stack trace,process name, business organization, region, etc.) in signatures. Thismetadata can include user-configurable regular expressions to broadenthe text classified by the classifier 206 as an error message.

Referring to FIG. 3, a non-limiting network environment 301 in whichvarious aspects of the disclosure can be implemented includes one ormore client machines 302A-302N, one or more remote machines 306A-306N,one or more networks 304, 304′, and one or more appliances 308 installedwithin the computing environment 301. The client machines 302A-302Ncommunicate with the remote machines 306A-306N via the networks 304,304′. The computing environment 301 can also be referred to as adistributed computer system.

In some examples, the client machines 302A-302N communicate with theremote machines 306A-306N via an intermediary appliance 308. Theillustrated appliance 308 is positioned between the networks 304, 304′and may also be referred to as a network interface or gateway. In someexamples, the appliance 308 can operate as an ADC to provide clientswith access to business applications and other data deployed in adatacenter, the cloud, or delivered as Software as a Service (SaaS)across a range of client devices, and/or provide other functionalitysuch as load balancing, etc. In some examples, multiple appliances 308can be used, and the appliance(s) 308 can be deployed as part of thenetwork 304 and/or 304′.

The client machines 302A-302N may be generally referred to as clientmachines 302, local machines 302, clients 302, client nodes 302, clientcomputers 302, client devices 302, computing devices 302, endpoints 302,or endpoint nodes 302. The remote machines 306A-306N may be generallyreferred to as servers 306 or a server farm 306. In some examples, aclient device 302 can have the capacity to function as both a clientnode seeking access to resources provided by a server 306 and as aserver 306 providing access to hosted resources for other client devices302A-302N. The networks 304, 304′ may be generally referred to as anetwork 304. The networks 304 can be configured in any combination ofwired and wireless networks.

A server 306 can be any server type such as, for example: a file server;an application server; a web server; a proxy server; an appliance; anetwork appliance; a gateway; an application gateway; a gateway server;a virtualization server; a deployment server; a Secure Sockets LayerVirtual Private Network (SSL VPN) server; a firewall; a web server; aserver executing an active directory; a cloud server; or a serverexecuting an application acceleration program that provides firewallfunctionality, application functionality, or load balancingfunctionality.

A server 306 can execute, operate, or otherwise provide an applicationthat can be any one of the following: software; a program; executableinstructions; a virtual machine; a hypervisor; a web browser; aweb-based client; a client-server application; a thin-client computingclient; an ActiveX control; a Java applet; software related to voiceover internet protocol (VoIP) communications like a soft InternetProtocol telephone; an application for streaming video and/or audio; anapplication for facilitating real-time-data communications; a HyperTextTransfer Protocol client; a File Transfer Protocol client; an Oscarclient; a Telnet client; or any other set of executable instructions.

In some examples, a server 306 can execute a remote presentationservices program or other program that uses a thin client or aremote-display protocol to capture display output generated by anapplication executing on a server 306 and transmit the applicationdisplay output to a client device 302.

In yet other examples, a server 306 can execute a virtual machineproviding, to a user of a client device 302, access to a computingenvironment. The client device 302 can be a virtual machine. The virtualmachine can be managed by, for example, a hypervisor, a virtual machinemanager (VMM), or any other hardware virtualization technique within theserver 306.

In some examples, the network 304 can be: a local area network (LAN); ametropolitan area network (MAN); a wide area network (WAN); a primarypublic network 304; and a primary private network 304. Additionalexamples can include a network 304 of mobile telephone networks that usevarious protocols to communicate among mobile devices. For short rangecommunications within a wireless local-area network (WLAN), theprotocols can include 802.11, Bluetooth, and Near Field Communication(NFC).

FIG. 4 depicts a block diagram of a computing device 401 useful forpracticing an example of client devices 302, appliances 308 and/orservers 306. The computing device 401 includes one or more processors403, volatile memory 422 (e.g., random access memory (RAM)),non-volatile memory 428, user interface (UI) 423, one or morecommunications interfaces 418, and a communications bus 450. Thecomputing device 401 may also be referred to as a computer or a computersystem.

The non-volatile memory 428 can include: one or more hard disk drives(HDDs) or other magnetic or optical storage media; one or more solidstate drives (SSDs), such as a flash drive or other solid-state storagemedia; one or more hybrid magnetic and solid-state drives; and/or one ormore virtual storage volumes, such as a cloud storage, or a combinationof such physical storage volumes and virtual storage volumes or arraysthereof.

The user interface 423 can include a graphical user interface (GUI) 424(e.g., a touchscreen, a display, etc.) and one or more input/output(I/O) devices 426 (e.g., a mouse, a keyboard, a microphone, one or morespeakers, one or more cameras, one or more biometric scanners, one ormore environmental sensors, and one or more accelerometers, etc.).

The non-volatile memory 428 stores an operating system 415, one or moreapplications 416, and data 417 such that, for example, computerinstructions of the operating system 415 and/or the applications 416 areexecuted by processor(s) 403 out of the volatile memory 422. In someexamples, the volatile memory 422 can include one or more types of RAMand/or a cache memory that can offer a faster response time than a mainmemory. Data can be entered using an input device of the GUI 424 orreceived from the I/O device(s) 426. Various elements of the computer401 can communicate via the communications bus 450.

The illustrated computing device 401 is shown merely as an exampleclient device or server and can be implemented by any computing orprocessing environment with any type of machine or set of machines thatcan have suitable hardware and/or software capable of operating asdescribed herein.

The processor(s) 403 can be implemented by one or more programmableprocessors to execute one or more executable instructions, such as acomputer program, to perform the functions of the system. As usedherein, the term “processor” describes circuitry that performs afunction, an operation, or a sequence of operations. The function,operation, or sequence of operations can be hard coded into thecircuitry or soft coded by way of instructions held in a memory deviceand executed by the circuitry. A processor can perform the function,operation, or sequence of operations using digital values and/or usinganalog signals.

In some examples, the processor can be embodied in one or moreapplication specific integrated circuits (ASICs), microprocessors,digital signal processors (DSPs), graphics processing units (GPUs),microcontrollers, field programmable gate arrays (FPGAs), programmablelogic arrays (PLAs), multicore processors, or general-purpose computerswith associated memory.

The processor 403 can be analog, digital or mixed. In some examples, theprocessor 403 can be one or more physical processors, or one or morevirtual (e.g., remotely located or cloud) processors. A processorincluding multiple processor cores and/or multiple processors canprovide functionality for parallel, simultaneous execution ofinstructions or for parallel, simultaneous execution of one instructionon more than one piece of data.

The communications interfaces 418 can include one or more interfaces toenable the computing device 401 to access a computer network such as aLocal Area Network (LAN), a Wide Area Network (WAN), a Personal AreaNetwork (PAN), or the Internet through a variety of wired and/orwireless connections, including cellular connections.

In described examples, the computing device 401 can execute anapplication on behalf of a user of a client device. For example, thecomputing device 401 can execute one or more virtual machines managed bya hypervisor. Each virtual machine can provide an execution sessionwithin which applications execute on behalf of a user or a clientdevice, such as a hosted desktop session. The computing device 401 canalso execute a terminal services session to provide a hosted desktopenvironment. The computing device 401 can provide access to a remotecomputing environment including one or more applications, one or moredesktop applications, and one or more desktop sessions in which one ormore applications can execute.

Additional descriptions of a computing device 401 configured as a clientdevice 302 or as a server 306, or as an appliance intermediary to aclient device 302 and a server 306, and operations thereof, may be foundin U.S. Pat. Nos. 9,176,744 and 9,538,345, which are incorporated hereinby reference in their entirety. The '744 and '345 patents are bothassigned to the current assignee of the present disclosure.

FIG. 5 illustrates an error remediation system (e.g., the system 100 ofFIG. 1) configured for operation within a distributed computing platform(e.g. the network environment 301 of FIG. 3). As shown in FIG. 5, theconfiguration 500 includes the client computer 302 and the servercomputers 306A and 306B of FIG. 3. Within the configuration 500, thecomputer systems 302, 306A, and 306B are communicatively coupled to oneanother and exchange data via a network (e.g., the networks 304 and/or304′ of FIG. 3).

As shown in FIG. 5, the server 306A is configured to host an SaaS and/orWeb application 510. The client 302 is configured to host a browser 502.The server 306B is configured to host the ER service 104 and the errordata store 106 of FIG. 1. The browser 502 includes a plugin 504 thatincludes the remediator 108 and the monitor 102 of FIG. 1. Many of thecomponents illustrated in FIG. 5 are described above with reference toFIGS. 1 and 3. For purposes of brevity, those descriptions will not berepeated here, but each of the components of FIGS. 1 and 3 included inFIG. 5 is configured to function in FIG. 5 as described in FIGS. 1 and3. However, the descriptions of any of these components may be augmentedor clarified below.

As illustrated in FIG. 5, the server 306 is configured to serve the SaaSand/or Web application 510 to the browser 502. As part of this service,the server 306 is configured to transmit the HTML 124 of FIG. 1 to theclient 302 using, for example, HyperText Transfer Protocol (HTTP), andthe browser 502 is configured to load the HTML 124 into a DOM 506.

In some examples of the configuration 500, the browser 502 is configuredto support DOM event notifications. In these examples, the monitor 102is configured to subscribe to these notifications and to receive andprocess the notifications to detect changed DOM objects. In otherexamples of the configuration 500, the browser 502 does not support DOMevent notifications. In these examples, the monitor 102 is configured topoll the browser 502 for a copy of the DOM 506 and process a sequence ofcopies of the DOM to detect changed objects. For instance, in at leastone example, to receive a consistent stream of copies to analyze, themonitor 102 is configured to transmit (e.g., via the system interface202 of FIG. 2) polling requests to the browser 502 on a periodic basis,such as between every two HTTP requests/responses. Regardless of thetechnique used to detect changed objects, the components of the errorremediation system illustrated in FIG. 5 are configured to interoperateto detect error messages represented in the changed objects and provideremediations as described above.

The configuration 500 is but one example of many potentialconfigurations that can be used to implement the system 100. Forinstance, in some examples, the monitor 102 is configured to providesignatures to the browser 502 rather than the ER service 104. In theseexamples, the browser 502 is configured to interoperate with the ERservice 104 to drive error message detection and remediation. In otherexamples, the monitor 102 can be configured to communicate signatures toother processes hosted by the client 302. In other examples, theremediator 108 is configured to interoperate with the browser 502 orother process hosted by the client 302 to provide remediations. As such,the examples disclosed herein are not limited to the particularconfiguration 500 and other configurations are considered to fall withinthe scope of this disclosure.

FIG. 6 illustrates an error remediation system (e.g., the system 100 ofFIG. 1) configured for operation within a distributed computing platform(e.g. the network environment 301 of FIG. 3). As shown in FIG. 6, theconfiguration 600 includes the client computer 302 and the servercomputers 306A and 306B of FIG. 3. Within the configuration 600, thecomputer systems 302, 306A, and 306B are communicatively coupled to oneanother and exchange data via a network (e.g., the networks 304 and/or304′ of FIG. 3).

As shown in FIG. 6, the server 306A is configured to host the SaaSand/or Web application 510 of FIG. 5. The client 302 is configured tohost a client application 602. The client application 602 includes anembedded browser 606, the remediator 108 of FIG. 1, and the monitor 102of FIG. 1. The embedded browser 606 can be implemented, for example,using the Chromium Embedded Framework. The server 306B is configured tohost a virtualization workspace service 604 and the error data store 106of FIG. 1. The workspace service 604 includes, as a service endpoint,the ER service 104 of FIG. 1. Many of the components illustrated in FIG.6 are described above with reference to FIGS. 1, 3, and 5. For purposesof brevity, those descriptions will not be repeated here, but each ofthe components of FIGS. 1, 3, and 5 included in FIG. 6 are configured tofunction in FIG. 6 as described in FIGS. 1, 3, and 5. However, thedescriptions of any of these components may be augmented or clarifiedbelow.

As illustrated in FIG. 6, the server 306A is configured to serve theSaaS and/or Web application 510 to the client application 602. As partof this service, the server 306A is configured to transmit the HTML 124of FIG. 1 to the client application 602. The client application 602 isconfigured to provide the HTML 124 to the embedded browser 606 and theembedded browser 606 is configured to load the HTML 124 into a DOM 506.

In some examples of the configuration 600, the client application 602 isconfigured to connect to the workspace service 604 during initializationand to update the monitor 102 and/or any of its components (e.g., thesystem interface 202, the filter 204, the classifier 206, and thesignature generator 208 of FIG. 2). In these examples, the clientapplication 602 is configured to provide the SaaS and/or Web application510 to an end user via the embedded browser 606. The monitor 102 isconfigured to detect error messages generated by the SaaS and/or Webapplication 510 during its provision by the client application 602 andto interoperate with the ER service 104 to identify remediationsassociated with detected error messages. To handle a situation in whicha remediation to an error message is identified, the monitor 102 isconfigured to provide the remediation to the remediator 108. As theremediator 108 has access to the DOM 506 in this configuration, theremediator 108 is configured to alter the DOM 506 to include aremediation message stored in the remediation. Thus, in thisconfiguration, the DOM 506 is configured to cause the error message andthe remediation message to be displayed concurrently to the end user.

The configuration 600 is but one example of many potentialconfigurations that can be used to implement the system 100. Forinstance, in some examples, the monitor 102 is configured to providesignatures to the embedded browser 606 or the client application 602rather than the ER service 104. In these examples, the embedded browser606 or the client application 602 is configured to interoperate with theER service 104 to drive error message detection and remediation inconjunction with the remediator 108. In other examples, the embeddedbrowser 606 includes and/or is extended by the monitor 102. As such, theexamples disclosed herein are not limited to the particularconfiguration 600 and other configurations are considered to fall withinthe scope of this disclosure.

FIG. 7 illustrates an error remediation system (e.g., the system 100 ofFIG. 1) configured for operation within a distributed computing platform(e.g. the network environment 301 of FIG. 3). As shown in FIG. 7, theconfiguration 700 includes the client computer 302 and the servercomputers 306A-306C of FIG. 3. Within the configuration 700, thecomputer systems 302 and 306A-306C are communicatively coupled to oneanother and exchange data via a network (e.g., the networks 304 and/or304′ of FIG. 3).

As shown in FIG. 7, the server 306C is configured to host the SaaSand/or Web application 510 of FIG. 5. The client 302 is configured tohost a browser 708 and a VDA client agent 706. The server 306A isconfigured to host a virtual machine 702. The virtual machine 702 isconfigured to host a VDA 704 and the browser 502 of FIG. 5. The VDA 704and the VDA client agent 706 are configured to establish avirtualization infrastructure between the client 302 and the server306A. The server 306B is configured to host the ER service 104 and theerror data store 106 of FIG. 1. Many of the components illustrated inFIG. 7 are described above with reference to FIGS. 1, 3, and 5. Forpurposes of brevity, those descriptions will not be repeated here, buteach of the components of FIGS. 1, 3, and 5 included in FIG. 7 areconfigured to function in FIG. 7 as described in FIGS. 1, 3, and 5.However, the descriptions of any of these components may be augmented orclarified below.

As illustrated in FIG. 7, the server 306C is configured to serve theSaaS and/or Web application 510 to the browser 502. As part of thisservice, the server 306C is configured to transmit the HTML 124 of FIG.1 to the virtual machine 702. The virtual machine 702 is configured toprovide the HTML 124 to the browser 502, and the browser 502 isconfigured to load the HTML 124 into the DOM 506 of FIG. 5. Thecomponents of the error remediation system illustrated in FIG. 7 areconfigured to interoperate with the browser 502 to detect error messagesrepresented in changed objects and provide remediations as describedabove. The VDA 704 and the VDA client agent 706 are configured tointeroperate to provide the UI of the virtual machine 702 to an end uservia the browser 708, thereby providing the end user with secure accessto the SaaS and/or Web application 510. In some examples, the VDA 704and the VDA client agent 706 are further configured to update themonitor 102 and/or any of its components (e.g., the system interface202, the filter 204, the classifier 206, and the signature generator 208of FIG. 2) in the background during initialization or on-going operationof the virtual machine 702.

The configuration 700 is but one example of many potentialconfigurations that can be used to implement the system 100. Forinstance, in some examples, the monitor 102 is configured to providesignatures to the VDA 704 rather than the ER service 104. In theseexamples, the VDA 704 is configured to interoperate with the ER service104 to drive error message detection and remediation in conjunction withthe remediator 108. More specifically, in some examples, the VDA 704 canbe configured to host the remediator 108 and/or the monitor 102. Assuch, the examples disclosed herein are not limited to the particularconfiguration 700 and other configurations are considered to fall withinthe scope of this disclosure.

FIG. 8 illustrates an error remediation system (e.g., the system 100 ofFIG. 1) configured for operation within a distributed computing platform(e.g. the network environment 301 of FIG. 3). As shown in FIG. 8, theconfiguration 800 includes the client computer 302, the server computers306A and 306B, and the gateway computer 308 of FIG. 3. Within theconfiguration 800, the computer systems 302, 306A, 306B, and 308 arecommunicatively coupled to one another and exchange data via a network(e.g., the networks 304 and/or 304′ of FIG. 3).

As shown in FIG. 8, the server 306B is configured to host the SaaSand/or Web application 510 of FIG. 5. The server 306A is configured tohost the virtualization workspace service 604 of FIG. 6 and the errordata store 106 of FIG. 1. The workspace service 604 includes the ERservice 104 of FIG. 1. The gateway 308 is configured to host the monitor102 and the gateway process 126 of FIG. 1. The client 302 is configuredto host a client application 802. The client application 802 includesthe embedded browser 606 of FIG. 6 and the remediator 108 of FIG. 1.Many of the components illustrated in FIG. 8 are described above withreference to FIGS. 1, 3, 5, and 6. For purposes of brevity, thosedescriptions will not be repeated here, but each of the components ofFIGS. 1, 3, 5, and 6 included in FIG. 8 are configured to function inFIG. 8 as described in FIGS. 1, 3, 5, and 6. However, the descriptionsof any of these components may be augmented or clarified below.

As illustrated in FIG. 8, the server 306B and the gateway 308interoperate to serve the SaaS and/or Web application 510 to theembedded browser 606. The gateway process 126 is configured to updatethe monitor 102 and/or any of its components (e.g., the system interface202, the filter 204, the classifier 206, and the signature generator 208of FIG. 2) prior to serving the SaaS and/or Web application 510. As partof serving the SaaS and/or Web application 510, the server 306B isconfigured to transmit the HTML 124 of FIG. 1 to the gateway process126. The gateway process 126 is configured to transmit the HTML 124 theclient application 802. The client application 802 is configured toreceive the HTML 124 and to load the HTML 124 into the DOM 506 fordisplay to an end user of the client application 802.

Further, in some examples, the gateway process 126 is configured todetermine whether the HTML 124 is a response from the SaaS and/or Webapplication 510 to the embedded browser 606. For instance, in someexamples, the gateway process 126 is configured to determine whether theHTML 124 is tagged with the appInstanceID previously assigned to theSaaS and/or Web application 510 by the gateway process 126 when the SaaSand/or Web application 510 was launched. The gateway process 126 isfurther configured to provide the HTML 124 to the monitor 102 where theHTML 124 is a response from the SaaS and/or Web application 510.

In some examples of the configuration 800, the monitor 102 is configuredto compare the HTML 124 to HTML 804 to determine whether the HTML 124has any changed objects. The HTML 804 is a copy of a previous version ofthe HTML 124. The monitor 102 is also configured to store a copy of theHTML 124 for future comparative purposes. In some examples, the monitor102 is also configured to interoperate with the ER service 104 asdescribed above to identify any error messages and correspondingremediations. To handle the situation where a remediation is identified,the monitor 102 interoperates with the remediator 108 to apply theremediation. As the remediator 108 has access to the DOM 506 in thisconfiguration, the remediator 108 is configured to alter the DOM 506 toinclude a remediation message stored in the remediation. Thus, in thisconfiguration, the DOM 506 is configured to cause the error message andthe remediation message to be displayed concurrently to the end user.The monitor 102 is further configured to provide the appInstanceID tagfrom the HTML 124 to the remediator 108. In cases where there may bemultiple concurrent instances of SaaS and/or Web application 510 beingdisplayed by the embedded browser 606, the appInstanceID tagadvantageously allows the remediator 108 to apply the remediation to theDOM 506 displaying the corresponding instance of SaaS and/or Webapplication 510.

The configuration 800 is but one example of many potentialconfigurations that can be used to implement the system 100. As such,the examples disclosed herein are not limited to the particularconfiguration 800 and other configurations are considered to fall withinthe scope of this disclosure.

FIG. 9 illustrates an error remediation system (e.g., the system 100 ofFIG. 1) configured for operation within a distributed computing platform(e.g. the network environment 301 of FIG. 3). As shown in FIG. 9, theconfiguration 900 includes the client computer 302 and the servercomputers 306A and 306B of FIG. 3. Within the configuration 900, thecomputer systems 302, 306A, and 306B are communicatively coupled to oneanother and exchange data via a network (e.g., the networks 304 and/or304′ of FIG. 3).

As shown in FIG. 9, the client 302 is configured to host a virtualapplication client 904 and the VDA client agent 706. The virtualapplication client 904 includes the remediator 108 of FIG. 1. The server306B is configured to host a virtual machine 702. The virtual machine702 is configured to host a VDA 704, a local application 902, and themonitor 102 of FIG. 1. The VDA 704 and the VDA client agent 706 areconfigured to establish a virtualization infrastructure between theclient 302 and the server 306B. The server 306A is configured to host avirtualization workspace service 604 and the error data store 106 ofFIG. 1. The workspace service 604 includes the ER service 104 of FIG. 1.Many of the components illustrated in FIG. 9 are described above withreference to FIGS. 1, 3, 6, and 7. For purposes of brevity, thosedescriptions will not be repeated here, but each of the components ofFIGS. 1, 3, 6, and 7 included in FIG. 9 are configured to function inFIG. 9 as described in FIGS. 1, 3, 6, and 7. However, the descriptionsof any of these components may be augmented or clarified below.

As illustrated in FIG. 9, in some examples the virtual applicationclient 904 is configured to provide an end user with a virtual versionof the application 902 via the VDA client agent 706 and the VDA 704. Inthese examples, the virtual application client 904 is configured totransmit via the VDA client agent 706 (e.g., via a virtual channel) arequest to the VDA 704 to update the monitor 102 prior to launching theapplication 902. The VDA 704 is configured to process this request byinteroperating with the ER service 104 to update the monitor 102 and/orany of its components (e.g., the system interface 202, the filter 204,the classifier 206, and the signature generator 208 of FIG. 2) and toinitiate execution of the monitor 102. In these examples, the monitor102 is configured to subscribe to UI automation message and/or hookmessages descriptive of the UI of the application 902 and to use thesemessages to detect changed elements, as described above. The monitor 102is also configured to interoperate with the ER service 104 as describedabove to identify any error messages and corresponding remediations. Tohandle the situation where a remediation is identified, the monitor 102interoperates with the remediator 108, via the virtualizationinfrastructure established by the VDA client agent 706 and the VDA 704,to apply the remediation. As the remediator 108 is embedded within thevirtual application client 904, the remediator 108 is configured torequest that the virtual application client 904 present a remediationmessage stored in the remediation in conjunction with the error message.Alternatively or additionally, the remediator 108 can install a softwarefix to the virtual application client 904 and/or the VDA client agent706, where the remediation instructs the same.

The configuration 900 is but one example of many potentialconfigurations that can be used to implement the system 100. Forinstance, in some examples, the monitor 102 is configured to acquire UIdata by loading a hook dynamic link library into the application 902rather than (or in addition to) via an independent process. In otherexamples, the monitor 102 is configured to launch a separate,independent global hook process that monitors the application 902. Inother examples, the classifier 206 of FIG. 2 is implemented as a virtualcomponent within the monitor 102 that is physically implemented as aservice in the workspace 604. In this example, the classifier 206 isconfigured to expose an API that accepts changed objects or elements astext values and that returns an indication of whether the changed objector element includes an error message. In other examples, the virtualmachine 702 is configured to host the remediator 108. In these examples,the remediator 108 is configured to apply remediations to the UI of theapplication 902 within the virtual machine 702, thereby providing themto the client via the normal processing of the virtualizationinfrastructure established by the VDA client agent 706 and the VDA 704.As such, the examples disclosed herein are not limited to the particularconfiguration 900 and other configurations are considered to fall withinthe scope of this disclosure.

Error Remediation Processes

As described above, some examples of the system 100 of FIG. 1 areconfigured to execute error remediation processes. FIG. 10 illustratesan error remediation process 1000 executed by the system 100 in someexamples.

The process 1000 starts with a UI monitor (e.g., the UI monitor 102 ofFIG. 1) monitoring 1002 the UI of a monitored application. For example,the monitor can subscribe to receive notifications regarding UI datafrom the monitored application and/or from other system processes (e.g.,hook processes and/or UI automation processes) that monitor themonitored application. Alternatively or additionally, the monitor canperiodically poll the monitored application and/or other systemprocesses to acquire UI data.

The monitor detects 1004 a change in one or more elements of the UI. Forinstance, the monitor can execute a filter (e.g., the UI data filter 204of FIG. 2) that processes the UI data to detect changes therein. In someexamples, the notifications received during monitoring 1002 aredescribed of the changes and the filter need only parse them to detectthe changes. In other examples, the filter maintains a sequence ofrepresentations of the UI and compares members of the sequence to detectchanges.

The monitor determines 1006 whether filtered changes indicate thepresence of an error message in the UI. For instance, the monitor canexecute a classifier (e.g., the UI classifier 206) that classifies thefiltered changes as either representing or not representing an errormessage. The classifier can operate on text and/or image data, asdescribed above. Where the monitor determines 1006 that the filteredchanges do not represent an error message, the monitor returns tomonitoring 1002 the UI data.

Where the monitor determines 1006 that the filtered changes do representan error, the monitor generates 1008 an error signature. For instance,the monitor can execute a signature generator (e.g., the signaturegenerator 208 of FIG. 2). The signature can include portions of arepresentation of a hierarchy of UI elements present in the UI. Forinstance, the signature can include a root object or element of the UIand a line of descendants of the root terminating in the object orelement that represents the error message.

An ER service (e.g., the ER service 104 of FIG. 1) determines 1010whether the error message has been triaged by support personnel. Forinstance, the monitor can transmit a request to the ER service thatincludes the signature. In response, the ER service can search acollection of error records (e.g., the error data store 106) todetermine whether a record storing the signature and a remediationexists in the collection. Where the ER service determines 1010 that arecord storing the signature and the remediation exists in thecollection, the ER service identifies 1012 the remediation by accessinga field in the record storing an identifier of the remediation.

Where the ER service determines 1010 that no record storing thesignature and a remediation exists in the collection, the ER servicedetermines 1016 whether a record storing the signature exists in thecollection. Where the ER service determines 1016 that a record storingthe signature exists in the collection, the ER service increments 1018one or more counters in the record. For instance the ER service mayincrement 1018 an instance counter in the record, a user counter (e.g.,where a user encountered the error for the first time in this instance),and an organization counter (e.g., where a user associated with abusiness organization was the first to encounter the error in thisinstance). In these examples, the error records may be stored inassociation with lists of users and organizations who have encounteredthe error. Where the ER service determines 1016 that no record storingthe signature exists in the collection, the ER service adds 1020 arecord storing the signature to the collection.

A remediator (e.g., the remediator 108 of FIG. 1) provides 1014 theremediation. For instance, the ER service can transmit the remediationto the monitor in response to its early request and the monitor cantransmit a request to the remediator to execute the remediation.Alternatively or additionally, the ER service can bypass the monitor andtransmit the remediation directly to the remediator. In any case, suchprovision 1014 can include displaying a remediation message inconjunction with the error message. Alternatively or additionally, suchprovision can include deploying a fix to a component installed on thesystem hosting the remediator.

The ER service determines 1022 whether the counter stored in the recordhas transgressed a user-configurable threshold value (e.g., 1, 5, 10,20, 50, 100, etc.). Where the ER service determines 1022 that thecounter has not transgressed the threshold value, the ER serviceterminates this instance of processing. Where the ER service determines1022 that the counter has transgressed the threshold value, the ERservice creates 1024 a support ticket (e.g., by transmitting a requestto a support automation system) where no ticket or remediation for theerror exists. The ER service updates 1026 the collection with the ticketnumber and terminates this instance of processing.

Processes in accordance with the process 1000 enable the system 100 todetect and quickly remediate errors encountered by end users, asdescribed herein.

Error Triage Interface

As described above, in various examples disclosed herein, a triageinterface (e.g., the triage interface 110 of FIG. 1) provides a userinterface to enable support personnel to triage errors encountered byend users and provide remediations to the errors. FIG. 11 illustratesone example of a triage interface screen 1100 provided by one example ofthe triage interface.

As shown in FIG. 11, the screen 1100 is organized into columns and rows.In some examples, the triage interface is configured to provide a rowfor each an error record stored in an error data store (e.g., the errordata store 106 of FIG. 1), subject to one or more filters. Types ofinformation stored in or associated with an error record that can beused by the triage interface to filter the rows provided in the screen1100 include business organization, region, site, user, and errormessage to name a few.

As shown in FIG. 11, the screen 1100 includes an app/URL column 1102, anerror column 1104, an impact column 1106, a remediation message column1108, a remediation link column 1110, and an update column 1112. Theapp/URL column 1102 includes a set of controls that each display anidentifier (e.g., a name) of an app/URL that generated one or more errormessages. The error column 1104 includes a set of controls that eachdisplay an error message encountered by an end user. The impact column1106 includes a set of controls that each display a number of end userswho have encountered the error message. The remediation message column1108 includes a set of controls that each are configured to accept textarticulating a remediation message to display in conjunction with theerror message. The remediation link column 1110 includes a set ofcontrols that each are configured to accept text articulating ahyperlink to display in conjunction with the error message. Thehyperlink can, for example, link to an article describing a workaroundfor the error or a fix for the error. The update column 1112 includes aset of controls that are configured to be selectable via input. In someexamples, selection of a control in the column 1112 selects the rowincluding the selected control.

In some examples, a triage interface is configured to execute a triageprocess using the screen 1100. One example of a triage process 1200 inaccordance with these examples is illustrated in FIG. 12. As shown inFIG. 12, the process 1200 starts with the triage interface providing1202 a triage interface screen (e.g., the screen 1100 of FIG. 11). Thetriage interface receives 1204 input (e.g., a selection of a control ofthe interface screen). The triage interface determines 1206 whether atext control (e.g., a control from either column 1108 or column 1110)was selected.

Where the triage interface determines 1206 that a text control wasselected, the triage interface receives 1210 text input and stores thatinput in the selected control. Where the triage interface determines1206 that a text control was not selected, the triage interfacedetermines 1208 whether an update control (e.g. a control from column1112) was selected.

Where the triage interface determines 1208 that an update control wasnot selected, the triage interface returns to receiving 1204 input.Where the triage interface determines 1208 that an update control wasselected, the triage interface updates 1212 an error record associatedwith the selected row. In executing the update, the triage interfacereplaces the values in the error record with the contents of the textcontrols in the selected row.

The processes disclosed herein each depict one particular sequence ofacts in a particular example. Some acts are optional and, as such, canbe omitted in accord with one or more examples. Additionally, the orderof acts can be altered, or other acts can be added, without departingfrom the scope of the apparatus and methods discussed herein.

Having thus described several aspects of at least one example, it is tobe appreciated that various alterations, modifications, and improvementswill readily occur to those skilled in the art. For instance, examplesdisclosed herein can also be used in other contexts. Such alterations,modifications, and improvements are intended to be part of thisdisclosure and are intended to be within the scope of the examplesdiscussed herein. Accordingly, the foregoing description and drawingsare by way of example only.

The invention claimed is:
 1. A computer system comprising: a memory; anetwork interface; and at least one processor coupled to the memory andthe network interface and configured to: monitor a user interfacecomprising a set of user interface elements, wherein each user interfaceelement in the set has a visual appearance in the user interface;evaluate a difference in the visual appearance of at least one changedelement within the set of user interface elements, wherein thedifference includes a visual representation of an identified keywordthat is added to the visual appearance of the at least one changedelement; determine whether the identified keyword indicates an error bysearching for the identified keyword in a dictionary that correlates aplurality of keywords with a plurality of error messages; in response toidentifying a particular error message that is correlated with theidentified keyword in the dictionary, classify the at least one changedelement as indicating the error; generate, in response to classifyingthe at least one changed element as indicating the error, an errorsignature that identifies the at least one changed element; identify,using the error signature, a remediation for the error; and provide theremediation in association with the at least one changed element.
 2. Thecomputer system of claim 1, wherein at least one of the user interfaceelements in the set is represented in hypertext markup language (HTML)and the at least one processor is configured to monitor the userinterface at least in part by scanning a document object modelrepresenting the at least one of the user interface elements in the setthat is represented in HTML.
 3. The computer system of claim 1, whereinthe at least one processor is configured to monitor the user interfaceat least in part by exchanging messages with a user interface automationprocess.
 4. The computer system of claim 1, wherein the at least oneprocessor is configured to monitor the user interface at least in partby executing a browser plugin.
 5. The computer system of claim 4,wherein the at least one processor resides within a server and isfurther configured to implement a browser configured to: execute thebrowser plugin; and provide the remediation in association with the atleast one changed element.
 6. The computer system of claim 4, whereinthe at least one processor resides within a client computing device andis further configured to implement an application comprising an embeddedbrowser configured to: execute the browser plugin; and provide theremediation in association with the at least one changed element.
 7. Thecomputer system of claim 4, wherein the at least one processor resideswithin a client computing device and is further configured to implementan application comprising an embedded browser configured to provide theremediation in association with the at least one changed element.
 8. Thecomputer system of claim 1, wherein at least one of the user interfaceelements in the set is represented in hypertext markup language (HTML),and, the at least one processor resides within a gateway and isconfigured to monitor the user interface at least in part by scanningHTML for changes.
 9. The computer system of claim 1, wherein the atleast one processor is configured to monitor the user interface at leastin part by executing a background application configured to processnotifications regarding user interface events.
 10. The computer systemof claim 1, wherein the at least one processor is configured to monitorthe user interface at least in part by loading a library into anapplication configured to provide the user interface.
 11. The computersystem of claim 1, wherein the keyword is identified by executing amachine learning process that is trained to recognize user interfaceelements commonly displayed at particular locations when one or more ofthe error messages are encountered.
 12. The computer system of claim 11,wherein the machine learning process is tailored to a type of monitoredapplication.
 13. The computer system of claim 11, wherein the at leastone changed element is stored as image data and the at least oneprocessor is configured to execute an optical character recognitionprocess and/or a computer vision process to process the image data. 14.The computer system of claim 1, wherein the at least one processor isconfigured to generate the error signature using a hierarchy of userinterface elements terminating with the at least one changed element, anidentifier of an application that generated the at least one changedelement, and/or metadata descriptive of the at least one changedelement.
 15. The computer system of claim 1, wherein the at least oneprocessor is configured to provide the remediation at least in part bydisposing a remediation message either over or adjacent to the at leastone changed element.
 16. The computer system of claim 1, wherein the atleast one processor is configured to provide the remediation at least inpart by providing a remediation message in a window distinct from the atleast one changed element.
 17. The computer system of claim 1, furthercomprising a server, wherein the at least one processor is furtherconfigured to transmit the error signature to the server via the networkinterface and the server is configured to: receive a plurality of errorsignatures including the error signature; calculate a count of each typeof error signature; provide the count within a triage interface screen;and receive, via the triage interface screen, input specifyingremediations for each type of error signature.
 18. The computer systemof claim 17, wherein the server is further configured to filter theplurality of error signatures to include error signatures specific to anapplication, region, and/or business organization.
 19. The computersystem of claim 1, wherein the at least one processor is configured toprovide the remediation at least in part by installing a fix on thecomputer system.
 20. A method of remediating software application errorscomprising: monitoring, by a computer system, a user interfacecomprising a set of user interface elements, wherein each user interfaceelement in the set has a visual appearance in the user interface;evaluating, by the computer system, a difference in the visualappearance of at least one changed element within the set of userinterface elements, wherein the difference includes a visualrepresentation of an identified keyword that is added to the visualappearance of the at least one changed element; determine whether theidentified keyword indicates an error by searching, by the computersystem, for the identified keyword in a dictionary that correlates aplurality of keywords with a plurality of error messages; identifying,by the computer system, a particular error message that is correlatedwith the identified keyword in the dictionary; classifying, by thecomputer system, the at least one changed element as indicating theerror; generating, by the computer system in response to classifying theat least one changed element as indicating the error, an error signaturethat identifies the at least one changed element; transmitting, by thecomputer system, the error signature to a server; receiving, from theserver by the computer system, a remediation to the error; andproviding, by the computer system, the remediation in association withthe at least one changed element.
 21. The method of claim 20, whereinmonitoring the user interface comprises monitoring the user interfacevia a browser plugin.
 22. The method of claim 20, wherein the keyword isidentified by executing a machine learning process that is trained torecognize user interface elements commonly displayed at particularlocations when one or more of the error messages are encountered. 23.The method of claim 20, wherein generating the error signature comprisesusing a hierarchy of user interface elements terminating with the atleast one changed element, an identifier of an application thatgenerated the at least one changed element, and/or metadata descriptiveof the at least one changed element.
 24. The method of claim 20, whereinproviding the remediation comprises disposing a remediation messageeither over or adjacent to the at least one changed element.
 25. Themethod of claim 20, further comprising: receiving, by the server, aplurality of error signatures including the error signature;calculating, by the server, a count of each type of error signature;providing, by the server, the count within a triage interface screen;and receiving, by the server via the triage interface screen, inputspecifying remediations for each type of error signature.